SAP Web IDE: Invalid backend response received by SCC

Connectivity between SAP Cloud Platform and an on premise SAP NetWeaver system is normally achieved via SAP Cloud Connector. A nice feature depending on this is the remote connection of SAP Web IDE to an on premise ABAP system. The feature allows to easily load apps from the ABAP system and change or extend them from everywhere.

For this feature to work, some ICF services must be active on the ABAP system and remote access enabled on SCC. If not, Web IDE cannot “talk” to NW ABAP. Some possible errors and solutions regarding the setup are shown in this blog.

Scenario

A NetWeaver ABAP system with Fiori apps is available and the SAP Cloud Connector is configured to expose the system to SAP Cloud. I am using the SAP NetWeaver ABAP 7.51 Developer Edition for the scenario.

In the destination section of SCP, the SCC is shown as connected and the destination NPL is configured and working. A connection tests gives back a successful message: SCP <–> SCC <–> NW works.

Problem

A developer tries to extend a Fiori app. In Web IDE, the project wizard for an extension project is used.

After selecting the on premise system destination, an error message is displayed. The actual error message can differ. Sometimes you see an informative error message or just some red text or maybe nothing.

Error messages

In all cases, you can check the log of SCC and see a detailed information on the error.

The error message is:

Access denied to /sap/bc/adt/discovery for virtual host npl:443

Solution

The ICF service /sap/bc/adt/discovery is not accessible. This can be because the user does not have the right permissions, or the service is not active in the NW system, or SCC is not exposing the service.

Alternative A: SCC not exposing service

Adding a service in SCC will only expose the exact path, not the sub path. Either you add all paths exactly in the resource list, or change the access policy to accept sub-paths too.

Root cause: Path only, excluding sub-paths.

Solution: Change this to will allow Web IDE to access the resource.

Alternative B: ICF service not active

In the NW ABAP system, got to transaction SICF and check node /sap/bc/adt. This node must be activated. By default, this node is deactivated and must be activated by Basis.

Root cause: Service deactivated

Solution: Activate node adt. Right click and select Activate Service.

Alternative C: Missing authorization

Check with SU53 and SAP Help what is missing and assign the right permissions to your user.

Result

After applying the correct solution, the developer can use the extension project wizard in SAP Web IDE to load available applications.

 

Adjust image size of Docker qcow2 file

Short version

Increase image size by 100GB:

qemu-img resize ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/Docker.qcow2 +100G

Resize partition:

qemu-system-x86_64 -drive file=~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/Docker.qcow2  -m 512 -cdrom ~/Downloads/gparted-live-0.30.0-1-amd64.iso -boot d -device usb-mouse -usb

Get an empty Docker.qcow2 image from my GitHub page and make your Docker use it:

https://github.com/tobiashofmann/sap-nw-abap-docker

How to adjust the Docker image size for using large containers like SAP NetWeaver ABAP

Docker uses an image file to store Docker containers. The file is named Docker.qcow2 and is located (on Mac) at:

~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/Docker.qcow2

By default, the file can grow to a size of 64 GB.

When you first start Docker, the size of this image is around 1.4GB. Adding containers, image, etc and it will grow to 64GB.

The 64GB default size can be seen when using qemu-img info:

qemu-img info ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/Docker.qcow2

When this limit is reached, Docker should automatically increase the size of the image, but this isn’t working always. As a result, when the image is at 64 GB, you can get an error message stating that the device is full:

no space left on device

At least with my Dockerfile for SAP NetWeaver ABAP Developer Edition Docker is not increasing the image file dynamically. Because of this I had to split the automatic installation process in two parts: base image setup and installation. I guess that right now the SAP Installation is filling up space faster than Docker can react.

The Docker.qcow2 file is a VM disk. Therefore, it is possible to manipulate it like any other virtual disk: you can increase the disk size and access files within the VM disk when you mount the image in a VM. An easy solution to change the disk size Docker has available to store images and containers is to increase the disk size. This can be done by using Qemu and GParted.

Preparations

Locate qcow2 on your Computer

Click on open in finder. Finder opens at the specified location.

Shut down Docker.

Make a backup of the Docker.qcow2 file.

Install QEMU

To install qemu, use brew on Mac.

brew install qemu

Now Qemu should be installed.

Download GParted

Download the x64 gparted ISO image from their web site: 

https://downloads.sourceforge.net/gparted/gparted-live-0.30.0-1-amd64.iso

Resize Docker.qcow2

Resizing the Docker.qcow2 file to a new size consists of two steps.

  1. Make the disk larger
  2. Adjust the partition

Increase disk size

First, let’s make the disk larger. SAP can occupy some space, make sure you add enough GB to the image. An additional 100 GB should do it.

qemu-img resize ~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/Docker.qcow2 +100G

Output is a simple status message.

Image resized.

Adjust partition table

To resize the image, start Qemu, use the GParted ISO image as boot file and mount the Docker.qcow2 disk.

qemu-system-x86_64 -drive file=~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/Docker.qcow2  -m 512 -cdrom ~/Downloads/gparted-live-0.30.0-1-amd64.iso -boot d -device usb-mouse -usb

I got some error messages, but Qemu started.

Starting the virtual machine will take some time. Be patient. Next you’ll have to configure the GParted ISO image.

The default values should be enough. This gives you a keyboard, mouse, English and X. After that, Gparted is started and you should see the Docker.qcow2 disk in the Gparted app.

Select the disk and click on Resize / Move. In the new size (MiB) field, enter the new size of the disk you need. The disk size is allocated dynamically and won’t occupy immediately space on your physical disk. So don’t be shy. Assign all free space to the partition.

Click on Resize/Move and on the Apply button

Last chance to stop. But as you need the new free space for Docker, click again on Apply.

The partition will be resized. In case something goes wrong, please restore the backup of the Docker.qcow2 file you made previously.

After the operation finishes, you can see that the partition is now offering 164GB.

Shutdown the VM. As the Docker.cqow2 file changed was the original one used by Docker, you have only to restart Docker to benefit from the new image size. Now you can use Docker to run SAP NetWeaver ABAP with just one command. As the Docker.qcow2 file is empty, even when the image size is reported as 4 GB, compressed (zipped) it’s just a few MB.

With the new Docker disk file you can even start SAP NetWeaver ABAP without getting the “no space left on device” message.

Image creation works. The space occupied by just the SAP NetWeaver ABAP image is already at 65 GB.

Start a container

docker run -P -h vhcalnplci --name nwabap751 -it nwabap:latest /bin/bash

In Kitematic

Start UUIDD

/usr/sbin/uuidd

Change to user npladm

su - npladm
startsap

Problem with starting SAP

When you log in to your container and run startsap, the program will fail. It will report that no instance profiles were found.

startsap

Take a look at the available profiles.

ls -1 /sapmnt/NPL/profile/

During the installation, the installation script installed the profile files for the container with the dummy name 4f65[…], after starting the container, we specified a specific host name: vhcalnplci. Of course, these do not match and make sapstart fail.

Let’s adjust the instance profile configuration.

  1. Rename files
  2. Substitute references to old hostname to correct one vhcalnplci
mv NPL_ASCS01_4f6e4ee4de40 NPL_ACS01_vhcalnplci
mv NPL_D00_4f6e4ee4de40 NPL_D00_vhcalnplci
sed -i -- 's/4f6e4ee4de40/vhcalnplci /g' *

Now run again sapstart and it should work. If not, stop and start the container and try again.

UUIDD problem when running SAP NW ABAP inside Docker

UUID is a good old problem when it comes to running SAP NetWeaver on Linux / SuSE. You have a problem when you log in to your SAP system and get an error message. The error message shows the root cause and solution: “The UUID daemon (uuidd) is not active (code 59999). Check SAP note 1391070.”

Solution

SAP NetWeaver isn’t meant to run in Docker. When the software was designed, Docker or event containerization wasn’t around (maybe SUN). NetWeaver assumes that it is executed inside a real Linux. And the Docker version of OpenSuSE isn’t 100% a real Linux. A lot of services you get “automatically” when installing OpenSuSE are not available. One of those is that the init.d system is not starting services. Because of this, there is no UUID daemon running.

Make sure that the UUIDD service is running. For a normal Linux distribution, I blogged about this at a previous blog of mine. In case you are using Docker with OpenSuSE, make sure that uuidd is installed and executed during the image creation:

Installation

RUN zypper --non-interactive install --replacefiles  uuidd

Execution

RUN mkdir /run/uuidd && chown uuidd /var/run/uuidd && /usr/sbin/uuidd

Result

With the UUIDD running, the logon to SAP NetWEeaver ABAP is working. No restart of NetWeaver is needed.

Install your own SAP NetWeaver ABAP system

Below is a list of links to blogs I wrote and I hope can help you when you install your own SAP NetWeaver ABAP system. The documentation is the by-product while I installed my demo/test system.

Installing Personas 3.0 on SAP NetWeaver 7.5

Pre-installation checks

Resources on pre-requirements for Personas 3

Check your kernel release and patch level

Personas 3 heavily depends on SAP Kernel patch level. It`s not like this is to give you more work, Personas simply depends on core functionality that is part of the kernel. When something is fixed there, you have to update your kernel.

Transaction: SM51

Select Release Notes

  • I can see that my kernel is release 745 with patch level 15.

Implement required SAP Notes

As of writing this text, the required SAP Notes by Personas 3.0 SP2 are:

  • 1926394 – SAP GUI for HTML: Rendering mode update
  • 1995776 – ITS up/down: restgui dialogs instead of applet execution
  • 2016640 – Invalid GUI input data: display – window dimension conflict
  • 2076084 – Ghost Elements in SAP Screen Personas
  • 2148349 – SAP Screen Personas Call transaction variant
  • 1970427 – SAP GUI for HTML: Rendering problems in Enterprise Portal (EP)

None of the notes needed to be implement. Running a recently release NW version has its vantages.

Install Personas 3 add-on

Unzip 51048325.zip. The file K-300AGINPERSONAS.SAR containing the add on is located in the folder \DATA_UNITS\PERSONAS_300_INST\DATA

  • Log on to client 000.
  • User: you cannot use SAP*, so make sure you have a user with the right permissions.
  • Transaction: SAINT

Upload SAR to NW.

Decompress

The PAT file is now available on the server, in EPS inbox.

Select start

Select: “Continue”.

Select: “Continue”.

Select: “Continue”.

Select “No”.

Confirm. Installation start. Hold tight, all will end well.

Confirm, and lean back and relax

Finish

If you can, please send the data to SAP.

Personas 3.0 is now available in the system

Update SPAM

Pre-requisite

Download SPAM update from SAP market place. Navigate to: Support Packages and Patches -> Browse Download Catalog

Go to: Additional Components -> SAP SPAM/SAINT UPDATE -> SAPM/SAINT UPDATE <NW version> -> Support Packages

Select SPAM version you want to install. Try to go for the latest version.

Save the file on your hard drive. If you want, you can use sapcar to check if the file is OK. If not, sapcar will fail and you`ll have to download the archive again.

Install SPAM/SAINT

Installation procedure can be found online at SAP Help.

  • Transaction: SPAM
  • Client: 000

Upload the SAR file to the server.

To finish the upload, click on decompress. This will make the content of the SAR file available for SPAM to process. Check the version of SPAM before update. You want to be sure that the update happened J

To start the update, go to Support Package -> Import SPAM/SAINT Update.

Click on OK. The status changes and you can see that an update is running.

In the status bar you can follow the status of the update. All should work just fine.

After the update finished, you can see that the version of SPAM was updated.

SAPGui Maximum runtime exceeded

Systems you work with have a timeout parameter. You may be logged on or an anonymous user, in both cases the system creates a session for you and controls its lifetime. This is not to remind you to get your work done rapidly, but mostly to ensure that a long living session is not eating up too much resource (so, short, yes, it is to ensure you get your work done rapidly). The timeout period for a session depends on your system. Normal time is between 10 minutes to 30 minutes. In a SAP NetWeaver ABAP system, the time is set by default to 10 minutes, or 600 seconds. The counter is reset each time a commit is issued by the running ABAP program.

It can, however happen that you reach a timeout.

What to do? I have to say that my system was a little bit busy. I restarted my dev system and all went back into normal. As an alternative, you can change the timeout parameter. How to do this and why you should not do this is explained in SAP Note 25528.

  • Profile parameter: rdisp/max_wprun_time
  • Tx: RZ10 (permanent change)
  • Tx: RZ11 (only until next restart)

Initial Setup of NetWeaver ABAP System

After installing a SAP NetWeaver ABAP system you have to carry out several initial configuration steps to get working system. You can do these manually or simplify your life and use the “new” configuration wizard that aids you through this. Right after finishing the installation of a NW ABAP system, sapinst shows you a confirmation dialog, which includes a link to an SAP Note: 1923064. This note explains how to execute the initial configuration wizard.

Don`t be too excited about the note. It does nothing more than redirect you to Configuration Guide available on SAP Market Place. There is some documentation about his available on SCN [1] and [2]. The wizard is available with NetWeaver ABAP 7.4/7.5 and is executed via the ABAP task manager. Two transactions are important to know:

  • STC01: ABAP task manager
  • STC02: Task list monitor

Task manager contains a list of tasks you have to execute and means that you will save time and won`t miss an important configuration step. The above linked guide shows how to assign the right permissions to a user. To run the wizard, go to the ABAP task manager.

Transaction: STC01

In a base NW 7.5 system, 60 tasks are available. Enough to get you started setting up a system.

For the initial setup for a NW ABAP system, out of the 60 tasks, SAP_BASIS_SETUP_INITIAL_CONFIG needs to be selected.

Task list: SAP_BASIS_SETUP_INITIAL_CONFIG

Select the tasks you want to run.

Note

The PSE file is created and configured by this task too. Default values are pretty weak/compatible. 1024 bits and SHA-1. I think it is a good idea and time to change this to somewhat more secure:

Execute

Appendix

[1] http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/90829a05-f29d-3010-209d-ee50240e7efd?QuickLink=index&overridelayout=true&59661390714528

[2] http://scn.sap.com/docs/DOC-41405

Install an SAP NetWeaver ABAP 7.5 system on SEL12

Pre-requisite

Download and install SUSE Enterprise Linux 12 from Suse and install it. The OS is available as 2 DVD ISOs, 7.6 GB of data. If I remember correctly, I only needed DVD1 in the end.

Download SAP NetWeaver 7.5 installation files. As DB, I am using MaxDB. Total of 5.35 GB:

  • Kernel
  • MaxDB
  • SWPM
  • Installation

Installation

Copy all files to your Linux server. Place them into a folder that everyone can access and unzip the files. I used /mnt/sapinst and gave all users read permission. This is necessary as the installer creates an SAP adm user and runs the installation under this user id. To start the installation, call the SAP Installation Wizard. Inform the basic data of the SAP system you are going to install:

  • Standalone
  • DB type: MaxDB
  • NetWeaver 7.5

The wizard will ask you to provide the sizing of the system. Of course, on a laptop, demo is enough.

A virtual IP and hostname can be configured, if you wish. Not necessary, recommended, but I opted to not use this.

With the gathered information, Yast2 is going to install additional software.

Next you have to inform the wizard where to find the installation data. That’s the files downloaded and extracted before. Do this for:

  • Software provisioning manager
  • Installation
  • Kernel
  • MaxDB

To add the medium, confirm that you want to had another one each time.

After adding all needed data medium, select no and also inform the wizard that you do not have an additional medium: No.

SUSE documentation told me that now sapinst is called and started. Did not work for me, so I had to start it manually (which, btw, means, that all the above steps were a waste of time as I had to add each medium again in sapinst). Nevertheless, in case you have more luck than me, sapinst should start and ask you some more questions like system name, SID, schema name, and so on. And then starts installation.

Takes a while. Import ABAP steps takes some time. In case anything is configured 100% and the system has all the libraries and the user premissions needed for an SAP system, the installation will just run through.

When you reach the last step of the installer, you can see that the NW ABAP system is being started and the final configuration is executed by calling some BAPIs.

Validation

After the installation is finished, you see the confirmation dialog. The dialog contains a SAP Note pointing to a note explaining how to speed up initial configuration of your new system. Read the note, or read my blog on this.

Now you can log on to the system.

In the system status, you can check the system information. Congratulations, it is a SAP NetWeaver ABAP 7.5 SP00 system!

Enable certificate based logon – 6 Test certificate based logon with Web Dispatcher

For the user to able to log on with his client certificate, SAP Web Dispatcher (WD) must forward it. In a SSL termination scenario, this means that the WD is authenticating itself against a SAP backend, and repasses the client certificate of the user inside a header. SAP Help. This is the scenario configured in the previous blogs and the one that must be tested. To test it, I`ll use the Fiori logon screen.

ICF

Change ICF node to use client certificate based logon

Transaction: SICF

Path: /default_host/sap/bc/ui5_ui5/ui2

Changing the procedure can give you some popups about the current configuration; depends what was already configured.

With this, to access the ICF node, the user must send a client certificate.

Test

Call the URL of the service in the browser. URL: https://nwgw74.tobias.de:8100/sap/bc/ui5_ui5/ui2/ushell/

A popup should appear (given that you have a valid client certificate installed). Select the right certificate.